Windows NTFS CVE-2026-69312

The attacker must hold a valid local user account on the target Windows system (PR:L) - remote-only network access without an established local session is insufficient. No special NTFS configuration, filesystem state, or non-default Windows features are cited as required; the NTFS driver is loaded by default on all Windows installations. Exploitation does not require administrator rights and requires no user interaction beyond the attacker's own actions. Limiting factors: the attacker must first obtain local access (e.g., interactive logon, RDP session, or code execution in a low-privileged local process); remote-only attackers cannot exploit this directly.

CVSS 7.8 (High) accurately reflects the local attack vector and low privilege requirement - this is not remotely exploitable without first obtaining local access, which meaningfully reduces exposure compared to an AV:N flaw. However, AC:L/UI:N means that once an attacker has a local session (e.g., via phishing, RDP credential theft, or a web-facing service running as a low-privileged user), elevation is straightforward and requires no further victim interaction. The combination of C:H/I:H/A:H signals full system compromise post-exploitation. No EPSS score is available in the provided data, and the CVE is not currently listed in the CISA KEV catalog, so active in-the-wild exploitation is not confirmed. No public POC has been identified at time of analysis. The breadth of affected Windows versions - from the end-of-extended-support Server 2012 through current Server 2025 and Windows 11 25H2 - means virtually every Windows environment is exposed until patched. Any organization running unpatched Windows endpoints, whether a large enterprise or a smaller IT operation, should treat this as a high-priority patch-cycle item given the trivial exploitation complexity once local access is achieved.

An attacker who has obtained a local user session on a Windows endpoint - for example, through credential phishing or lateral movement via a compromised low-privileged service account - crafts a malicious NTFS operation to trigger the out-of-bounds read in ntfs.sys. The kernel driver reads beyond the intended buffer, enabling the attacker to leak kernel memory and chain the read into a privilege escalation primitive, ultimately executing code as SYSTEM. No public POC has been identified at time of analysis, but the AC:L/UI:N vector indicates the exploitation path, once developed, requires no victim cooperation.